Offline retention repair - 1.0.9-stability-playtest.3

The previous offline preflight compared complete installed and incoming
libraries and treated differing artifact/patch hashes as an identity conflict.
An immutable mod can have a different display label, preparation receipt or
source patch container while retaining its verified logical content identity.
Copying complete multi-mod preparation groups also reintroduced duplicates
or unselected variants into the offline catalogue.

The new layer includes the race-release-repair overlay unchanged. It composes
the final first-party online_mod_profile.cpp and runtime_ui.cpp, and adds an
owned offline keep helper to DKRLegacyImportLibrary. Bounded path, tree-copy, hashing and
exclusive-job helpers are delegated unchanged from that final source. No
submodule, RecompiledFuncs or RecompiledPatches source is edited.

The helper plans from ProfileSources, not all entries of source libraries.
Matching immutable content is reused after SHA validation of its prepared
manifest and referenced blobs. Mod IDs, revision, bank, capability and
behaviour contracts must still agree; display labels, source patch containers
and artifact serialization do not establish a different content identity.

For missing content, a new hashed receipt is constructed from selected
entries only. Its selected storage trees and complete required source reviews
are staged, checked and published without replacing existing directories.
Reviews publish before complete preparation groups. An interrupted keep can
leave complete inactive copies, and a retry deduplicates those. Existing
activation/visibility metadata, labels, saves and settings are never copied
from the host or edited. The old code-package and Track Lab retention paths
remain, including their own hash, conflict and inactive-copy guards.

Optional keep jobs serialize within the process. Cancellation, descriptor,
file-count, byte-count, storage-space, link/reparse and source integrity checks
remain active. Real semantic inconsistencies or corrupt installed assets
produce a named error instead of being silently replaced or reported saved.
Admission still completes before this optional work, preserving active play.

The standalone synthetic test calls the actual linked production helper and
actual catalogue APIs. It reproduces the old validate_retained_merge failure
for renamed/repacked content, then checks reuse plus selected new-copy
publication, repeat no-ops, excluded unrelated conflicts, activation/label/save
preservation, true conflict rejection, corrupt installed blobs, cancellation,
revision handling and Linux symlink rejection. No ROM or game is executed.

The existing 96 party-runtime checks are rerun on both platforms to retain
the race-start/spectator regression coverage. Native compilation and package
audits retain every earlier online/music/security check. This offline-only
change does not alter simulation, wire schemas or playtest.2 peer identifiers.
Physical offline-mod and multiplayer playtesting remains the owner check.

The launcher source includes a composed copy of the final online UI. The
Open Lobbies filter controls move beneath the account details at widths over
1000 pixels. At smaller widths they stay above the list. A compact readiness
card follows Your online view and precedes Online guide on this tab. It uses
the same native widgets, fonts, colours and state/actions; text wraps to the
actual sidebar width. Host/Quick Join and Online Profile keep their original
readiness panels. No session, directory or joining logic changes here.
